Skip to content
yararules.org
Menu

YARA · Cod3nym detection-rules

COD3NYM_SUSP_NET_Shellcode_Loader_Indicators_Jan24

Detects indicators of shellcode loaders in .NET binaries

Suspicious / huntingCod3nym detection-rulesDetection Rule License 1.1Compiles with YARA-X
Author
Jonathan Peters
Date
2024-01-11
Modified
2024-01-12
Score / Quality
65 / 80

What this rule detects

Detects indicators of shellcode loaders in .NET binaries

Targets: Windows PE.

It defines 7 patterns (7 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-net-shellcode-loader-indicators-jan24.yarDetection Rule License 1.1
rule COD3NYM_SUSP_NET_Shellcode_Loader_Indicators_Jan24 : FILE
{
	meta:
		description = "Detects indicators of shellcode loaders in .NET binaries"
		author = "Jonathan Peters"
		id = "606a444a-b894-5076-8d5e-1716bbfa588e"
		date = "2024-01-11"
		modified = "2024-01-12"
		reference = "https://github.com/Workingdaturah/Payload-Generator/tree/main"
		source_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/yara/dotnet/suspicious_indicators.yar#L1-L22"
		license_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/LICENSE.md"
		hash = "c48752a5b07b58596564f13301276dd5b700bd648a04af2e27d3f78512a06408"
		logic_hash = "28267eb54a4108924df57512bbae9f47f51fd4860b3cf93c014d73b0d4b2dec2"
		score = 65
		quality = 80
		tags = "FILE"

	strings:
		$sa1 = "VirtualProtect" ascii
		$sa2 = "VirtualAlloc" ascii
		$sa3 = "WriteProcessMemory" ascii
		$sa4 = "CreateRemoteThread" ascii
		$sa5 = "CreateThread" ascii
		$sa6 = "WaitForSingleObject" ascii
		$x = "__StaticArrayInitTypeSize=" ascii

	condition:
		uint16( 0 ) == 0x5a4d and 3 of ( $sa* ) and #x == 1
}

Strings (7 patterns)

IdentifierTypeValueModifiers
$sa1text"VirtualProtect"ascii
$sa2text"VirtualAlloc"ascii
$sa3text"WriteProcessMemory"ascii
$sa4text"CreateRemoteThread"ascii
$sa5text"CreateThread"ascii
$sa6text"WaitForSingleObject"ascii
$xtext"__StaticArrayInitTypeSize="ascii

Condition

uint16( 0 ) == 0x5a4d and 3 of ( $sa* ) and #x == 1

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 3 patterns in ( $sa* ) must match.
  • Pattern $x must occur == 1 times.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • c48752a5b07b58596564f13301276dd5b700bd648a04af2e27d3f78512a06408

Licence & attribution

Author: Jonathan Peters

Source repository: Cod3nym detection-rules @ 86a04c4594

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 606a444a-b894-5076-8d5e-1716bbfa588e

Tags:FILE

Related rules